InfoSec Gamification By: Jose L. Quiñones @josequinones Learn how gamification works for infosec scenarios. This presentation was given on 9/18/2014 at the Init6 Meeting

1. INFOSEC GAMIFICATION Jose L. Quiñones, BS
MCP, MCSA, MCT, CEH,
CEI, GPEN, GCIH, RHCSA

2. HOW WE LEARN?
RTFM?
Discovery
Doing
Repetition
Mastering

3. LEVELS OF LEARNING
Knowledge: Exhibit memory of learned materials by recalling facts, terms,
basic concepts and answers
Comprehension: Demonstrate understanding of facts and ideas by
organizing, comparing, translating, interpreting, giving descriptions, and
stating the main ideas
Application: Using acquired knowledge. Solve problems in new situations by
applying acquired knowledge, facts, techniques and rules in a different way
Analysis: Examine and break information into parts by identifying motives or
causes. Make inferences and find evidence to support generalizations
Evaluation: Present and defend opinions by making judgments about
information, validity of ideas or quality of work based on a set of criteria
Synthesis: Compile information together in a different way by combining
elements in a new pattern or proposing alternative solutions

4. WHAT IS GAMIFICATION?
Is the use of game thinking and game mechanics in non-game
contexts to engage users in solving problems.
A review of research on gamification shows that most studies on
gamification find positive effects from gamification in education.
Strives to leverage people's natural desires for socializing, learning,
mastery, competition, achievement, status, self-expression, altruism,
or closure.

5. ASPECTS OF GAMIFICATION
Gamification strategies use rewards for players who accomplish
desired tasks or competition to engage players. Types of rewards
include points, achievement badges or levels, the filling of a progress
bar, or providing the user with currency.
Making the rewards for accomplishing tasks visible to other players
or providing leader boards are ways of encouraging players to
compete.

6. WE ALL LIKE WINNING …

7. HOW CAN WE USE IT?
Measure:
 Skills
 Knowledge
 Creativity
Identify Talent
 Who knew that guy/gal was that good?
Teach/Learn/Train
 Using realistic scenarios and specific areas of development

8. TYPES / TECHNIQUES
Capture the Flag
King of the hill / Free for all
Red Team /Blue Team
Puzzles
Scavenger Hunts
Specific Challenges

9. INFOSEC TOPICS
Systems Administration
Forensics
Local Exploitation/Privilege Escalation / Abuse
Network Penetration
Web Applications
Penetrating the perimeter (DMZ/Firewall)
Pivoting
Development/Coding/Programming
Reverse Engineering

10. WHERE TO FIND THEM?

11. ACTUALLY …

12. WHERE TO FIND STUFF TO
PRACTICE …
OWASP Webgoat:
 https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Iron Geek – Mutillidea:
 http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-
owasp-top-10
 http://sourceforge.net/projects/mutillidae/
HD Moore Metasploitable 2:
 http://sourceforge.net/projects/metasploitable/
 https://community.rapid7.com/docs/DOC-1875
Repository of Challenges: – http://capture.thefl.ag or http://captf.com
Exploit Development (Linux): http://exploit-exersices.com
Cyberaces.org: https://tutorials.cyberaces.org/tutorials

13. SO NOW YOU KNOW … LET’S JUMP
IN!

14. CODEFIDELIO.ORG
… and go to the challenges section.

15. THANKS!
Email: josequinones@codefidelio.org
Twitter: @josequinones
G+: https://plus.google.com/u/2/+JoseLQuinonesBorrero